Revoking a key still allows connections to OpenVPN

[graysky2]

Perhaps I am doing this incorrectly. I want to revoke a key, per the readme:

cd /etc/easy-rsa
easyrsa revoke targetkey
easyrsa gen-crl

So everything seems to be as I expect, I can also find an entry in /etc/easy-rsa/pki/index.txt that indicates that I revoked the targetkey:

R 260804130324Z 160808185030Z 03  unknown /CN=targetkey

What's unexpected is that I can still connect with this ovpn profile to the OpenVPN server despite the fact that the key has been revoked. Am I misunderstanding something? I believe the above should render the corresponding ovpn profile dead/unable to connect.

[funkypenguin]

Dumb question, but does your OpenVPN config include the "crl-verify" directive, referencing the CRL?

[u0m3]

Also, when you revoke the key, easy-rsa updates the files in the $key directory and I presume the files used in the server config are places somewhere else, in which case you need to overwrite the file clr.pem

[ecrist]

This is not a problem with Easy-RSA, but a problem with your OpenVPN configuration. See previous comments.